Yeda LMS — Client Integration Guide

1. Getting started

1.1 What you need from Yeda

Before writing any code, request the following from your Yeda account manager:

1.2 Access modes and authentication

Pick the one that matches your use-case:

Details of each are in §2.

1.3 First call: health check

Verify you can reach the API:

curl -s https://your-college.yeda.ai/api/health
# → {"status":"ok"}

1.4 Second call: log a student in

curl -s https://your-college.yeda.ai/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{
    "fieldname":  "email",
    "username":   "student@example.com",
    "password":   "…",
    "college_id": 40
  }'

Successful response returns auth.access_token, auth.expires_at, user, and isDocumentChecked. Use auth.access_token as a Bearer token for protected calls.

1.5 Third call: fetch the current user

curl -s https://<college-domain>/api/current-user \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

2. Authentication

2.1 User access tokens

Yeda issues OAuth2 personal access tokens (Laravel Passport). Present them as:

Authorization: Bearer <access_token>

Log in

POST /api/auth/login
Content-Type: application/json

{
  "fieldname":          "email",          // or "username"
  "username":           "student@ex.com",
  "password":           "…",
  "college_id":         40,
  "current_college_id": 40
}

Response (AuthResource):

{
  "auth": {
    "access_token":   "eyJ0eXAiOiJKV1Qi…",
    "firebase_token": "eyJhbGciOi…",
    "expires_at":     "2026-05-05 14:30:00",
    "suspended":      0
  },
  "user":              { /* current user — see §4.2 */ },
  "isDocumentChecked": 1
}

Alternative login flows

Register

POST /api/auth/register
Content-Type: application/json

{
  "college_id": 40,
  "email":      "new@example.com",
  "phone":      "+972501234567",   // optional, Israeli E.164
  "password":   "verys3cret!"
}

Forgot / reset password

POST /api/auth/forgot            # request reset email
POST /api/website/auth/reset     # complete reset
#   body: token, email, college_id, password, password_confirmation

Verify email / phone

After registration, Yeda may require verification before allowing further actions.

POST /api/auth/email-verification/send-code
POST /api/auth/email-verification/check-code   { "email_verification_code": 1234 }
GET  /api/auth/user/send-sms-code
POST /api/auth/user/check-sms-code             { "sms_code": "1234" }

2.2 College JWT (server-to-server)

For back-office automation that acts on behalf of your organisation (rather than a logged-in user), obtain a short-lived JWT:

POST /api/auth/colleges/{college}/jwt/byAdmin
Content-Type: application/json

{ "login": "admin@your-college.co.il", "password": "…" }

{ "token": "eyJhbGciOi…" }

2.3 Logout

Discard the token client-side, and optionally call:

POST /api/user-devices/{deviceId}/close

to terminate the device session server-side.

3. Conventions

3.1 Base URL and prefix

All endpoints live under /api on your college domain:

https://your-college.yeda.ai/api/...

3.2 College context

Yeda is multi-tenant. Nearly every endpoint expects current_college_id as a query-string or body parameter. Always include it.

3.3 Content types

• Requests: application/json — except file uploads, which use multipart/form-data.
• Responses: application/json — except binary downloads (PDF, XLSX, streamed files) and XML sitemaps.

3.4 Pagination

List endpoints return a Laravel pagination envelope:

{
  "data": [ /* items */ ],
  "meta": { "total": 421, "per_page": 15, "current_page": 1, "total_pages": 29 }
}

A few category endpoints use cursor pagination and return a next_cursor field instead.

3.5 Timestamps

ISO-8601 UTC (2026-04-20T14:30:00Z). Fields ending in _date are date-only (YYYY-MM-DD); fields ending in _time are time-only (HH:MM).

3.6 Error model

Laravel's standard envelope:

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json

{
  "message": "The given data was invalid.",
  "errors":  { "email": [ "The email field is required." ] }
}

Some endpoints use {"status":"success"} / {"status":"error","message":"…"} envelopes instead of 4xx codes. Treat them equivalently.

3.7 Rate limits

600 requests per minute per token (or per IP for unauthenticated traffic). Beyond that, you will receive 429 Too Many Requests.

3.8 Maintenance mode

GET /api/maintenance-mode
# → {"maintenance": false, "future_maintenance": "Sunday 20:00 UTC"}

Poll this to warn users before read-only windows.

4. What you can do — capabilities by use-case

Each section lists the endpoints you call, grouped by business outcome.

4.1 Browse the catalogue (no login required)

4.2 Current user self-service

All of these require a user bearer token.

Example — current-user response (simplified):

{
  "id":                 12345,
  "name":               "Ivan Ivanov",
  "email":              "ivan@example.com",
  "username":           "ivanivanov",
  "phone":              "+972501234567",
  "role":               "student",
  "college_id":         40,
  "current_college_id": 40,
  "email_confirmed_at": "2026-03-01T08:12:55Z",
  "is_active":          true,
  "image_url":          "https://cdn.example.com/users/12345.jpg",
  "locale":             "he"
}

4.3 List the user's enrolments

4.4 Learning: consume course content

4.5 Practices, exams, surveys

Same flow for all three: start → answer → close → view results.

Solutions for any question: POST/api/website/solution.

4.6 Enroll the user

4.7 Payments, subscriptions, coupons

4.7.1 Checkout

4.7.2 Payment-page iframe (Tranzila)

4.7.3 Subscriptions

4.7.4 Coupons

4.7.5 Refund requests

Customers can file a refund request themselves (no login required):

POST /api/orders/refund-request
Content-Type: application/json

{
  "name":    "…",
  "email":   "…",
  "phone":   "…",
  "order":   "…",
  "message": "…"
}

4.8 Teachers & ratings

4.9 Forums

4.10 Certificates & terms

4.11 Offline calendar (live classes)

Lets you create scheduled events that can be tied to a Zoom meeting.

Example — create event:

POST /api/offline-calendar/events
Authorization: Bearer <token>
Content-Type: application/json

{
  "title":              "Weekly lecture #3",
  "description":        "Trigonometry intro",
  "current_college_id": 40,
  "course_id":          128,
  "item_id":            5421,
  "event_date":         "2026-05-01",
  "event_time_start":   "09:00",
  "event_time_end":     "10:30",
  "color":              "#3B82F6",
  "teacher_email":      "teacher@school.co.il",
  "create_zoom_event":  true
}

4.12 Zoom (standalone)

4.13 Server-to-server integration (College JWT)

These endpoints are designed for your backend to call Yeda's backend. Use the College JWT from §2.2.

Example — grant course access by email:

curl -s -X POST "https://your-college.yeda.ai/api/colleges/40/openAccessToCourse" \
  -H "Authorization: Bearer $COLLEGE_JWT" \
  -H 'Content-Type: application/json' \
  -d '{
    "course_id":      128,
    "user_email":     "buyer@example.com",
    "user_name":      "New Buyer",
    "user_birthdate": "1995-07-12"
  }'

If the user does not yet exist, Yeda will create it and send a welcome email.

4.14 YedaLabs partner integration

If you run the YedaLabs video platform, these endpoints let you sync videos and completion data. Authenticated with the YedaLabs token.

Helper endpoints for migrating video sources:

• POST/api/video-migrate/get-vimeo-download-link
• POST/api/video-migrate/get-yedalabs-link

4.15 Vimeo integration

4.16 White-label embed

Trimmed "student-only" API for embedding Yeda into a partner site, scoped to a single college. Base prefix: /api/wl/colleges/{college}.

Self-service "me" endpoints (user token required):

4.17 Translations (i18n)

4.18 Utility

5. Integration recipes

5.1 Log the user in and fetch their profile

TOKEN=$(curl -s https://your-college.yeda.ai/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{
    "fieldname":  "email",
    "username":   "student@example.com",
    "password":   "s3cret",
    "college_id": 40
  }' | jq -r '.auth.access_token')

curl -s https://your-college.yeda.ai/api/current-user \
  -H "Authorization: Bearer $TOKEN"

5.2 Sell a course from your own landing page

# Your marketing site posts the buyer's email; Yeda creates the account if missing
curl -s -X POST https://your-college.yeda.ai/api/lp/payments/courses/128 \
  -H 'Content-Type: application/json' \
  -d '{"email":"buyer@example.com","college_id":40}'

The response contains the next step (redirect to hosted payment, or confirmation for zero-price orders).

5.3 Grant access to a course / bundle from your back-office

# 1. One-time: obtain a College JWT
JWT=$(curl -s -X POST https://your-college.yeda.ai/api/auth/colleges/40/jwt/byAdmin \
  -H 'Content-Type: application/json' \
  -d '{"login":"admin@your-college.co.il","password":"…"}' | jq -r '.token')

# 2. Any time afterwards: grant access
curl -s -X POST "https://your-college.yeda.ai/api/colleges/40/openAccessToCourse" \
  -H "Authorization: Bearer $JWT" \
  -H 'Content-Type: application/json' \
  -d '{
    "course_id":      128,
    "user_email":     "buyer@example.com",
    "user_name":      "Buyer Name",
    "user_birthdate": "1995-07-12"
  }'

5.4 Schedule a live class with Zoom

curl -s -X POST https://your-college.yeda.ai/api/offline-calendar/events \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "title":              "Weekly lecture #3",
    "current_college_id": 40,
    "course_id":          128,
    "item_id":            5421,
    "event_date":         "2026-05-01",
    "event_time_start":   "09:00",
    "event_time_end":     "10:30",
    "create_zoom_event":  true
  }'

5.5 Upload a video to Vimeo

curl -s -X POST https://your-college.yeda.ai/api/vimeo/upload \
  -H "Authorization: Bearer $TOKEN" \
  -F 'video=@/path/to/lesson.mp4' \
  -F 'name=Introduction to Trig'

5.6 Sync users from your corporate directory

curl -s -X POST "https://your-college.yeda.ai/api/colleges/40/directory-sync/users/sync" \
  -H "Authorization: Bearer $COLLEGE_JWT" \
  -H 'Content-Type: application/json' \
  -d '{ "users": [ { "external_id": "…", "email": "…", "name": "…", "groups": [ "…" ] } ] }'

5.7 Fetch a user's progress in a course

curl -s "https://your-college.yeda.ai/api/colleges/40/users/course-statistics?user_id=12345&course_id=128" \
  -H "Authorization: Bearer $COLLEGE_JWT"

Returns a structure with seconds watched, percentage completed, average exam grade, etc.

6. Webhooks you need to handle

6.1 Payment notifications (Tranzila)

Your Yeda instance exposes an inbound webhook URL that Tranzila calls after each successful or failed payment:

POST https://your-college.yeda.ai/api/payment-page/tranzila-notify/{orderId}

Configure this URL in your Tranzila dashboard. Yeda handles signature validation automatically; you do not need to re-validate it.

Return 200 OK with body OK. No custom payload parsing is required on your side — Yeda updates the order, dispatches notification jobs, and exposes the result via GET /api/payment-page/check-payment-status?order_id=….

Similar flows exist for:

ANY /api/payments/callback/{payment_system}
ANY /api/payments/purchase/{payment_system}/success
ANY /api/payments/purchase/{payment_system}/fail

6.2 Enrollment approval (signed URLs)

When a manual-approval enrollment is created, Yeda sends your chosen admin an email with two links:

GET /api/wl/enrollments/approve/{token}
GET /api/wl/enrollments/decline/{token}

Both are public and single-use — the token is signed and expires. Open them in a browser or call them server-side to approve / decline.

6.3 Stripe / Cardcom / Multipass / Alljobs

When enabled for your college, Yeda can also:

• Receive Stripe webhook events (signature verified with config('services.stripe.webhook.secret')).
• Handle Multipass XML transaction responses.
• Handle Alljobs coupon activations.

Ask your account manager to configure the relevant secrets before you begin testing.

7. Glossary

Need help?

Reach out to your Yeda account manager with:

1. The exact endpoint and HTTP method you're calling.
2. A sample request (headers + body) — mask any tokens.
3. The full response (status, headers, body).

Most questions get answered in a day or two.